CVE-2026-54121: Microsoft Active Directory Certificate Services privilege escalation

CVE-2026-54121 · Severity: high · CVSS 8.8 · Published 2026-07-14

A security vulnerability exists in Microsoft's Active Directory Certificate Services, which is used to manage digital identities and secure communications within a corporate network. An attacker with basic user access could exploit this flaw to gain higher-level administrative permissions. This could lead to a full takeover of the identity infrastructure, allowing unauthorized access to sensitive data and systems across the organization.

Technologies: Microsoft Windows Server 2012 R2, Microsoft Windows 10, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019. Vendors: Microsoft.

Quick answers

Is CVE-2026-54121 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54121 being exploited in the wild.
How severe is CVE-2026-54121?
High severity, with a CVSS score of 8.8, published 14 July 2026.
Which products and versions are affected?
Microsoft Windows 10 < 10.0.14393.9339; Microsoft Windows Server 2012 < 6.2.9200.26226 / < 6.3.9600.23291; Microsoft Windows Server 2016 < 10.0.14393.9339 / < 10.0.17763.9020.
Is there a fix for CVE-2026-54121?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54121 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-54121?
Check whether you run Microsoft Windows Server 2012 R2, Microsoft Windows 10, Microsoft Windows Server 2012 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285) exists in Microsoft Active Directory Certificate Services (AD CS). The flaw allows a remote attacker with low-privileged authenticated access to bypass authorization checks and escalate their privileges within the domain. The attack is carried out over the network without requiring user interaction. Successful exploitation could grant the attacker administrative control over the certificate authority or the broader Active Directory environment. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.

Affected products

  • Microsoft Windows 10 Version 1607 < 10.0.14393.9339
  • Microsoft Windows 10 Version 1809 < 10.0.17763.9020
  • Microsoft Windows Server 2012 / 2012 R2 < 6.2.9200.26226 / < 6.3.9600.23291
  • Microsoft Windows Server 2016 / 2019 < 10.0.14393.9339 / < 10.0.17763.9020

Timeline

  • 2026-07-14: disclosed: Initial publication by Microsoft and NVD
  • 2026-07-14: advisory: Microsoft MSRC advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.